Skip to main content

Test PowerShell as SYSTEM with PsExec on Windows

What

FileWave isruns Windows deployment scripts as the local SYSTEM account. Microsoft PsExec lets you test a UnifiedPowerShell Endpointscript Management toolin that allowssame organizationssecurity tocontext manage and deploy software and settings to macOS, Windows, iOS, iPadOS, tvOS, Chrome, and Android devices. Whenbefore deploying PowerShell scriptsit through FileWave, it is important to test the scripts on a WindowsFileset deviceor beforehandCustom to ensure that they will function correctly when run through FileWave.Field.

When/Why

Current FileWave runsWindows allclients are 64-bit. Test with 64-bit PowerShell scriptsunless inyou 32bitare reproducing a legacy 32-bit execution path. For script-based Custom Fields, the On Windows, run as 64-bit setting controls the PowerShell andarchitecture. runs them as SYSTEM. By testing the scripts on a Windows device using PsExec and executing the .ps1 scriptTesting as SYSTEM withcatches 32bitdifferences PowerShell,in organizationspermissions, canprofile gainpaths, amapped betterdrives, understandingregistry of how the script will function when run through FileWave. This can help prevent potential issueshives, and ensureuser-specific thatenvironment the scripts function as intended when deployed to devices.variables.

How

  1. Download PsExec from the Sysinternals Suite (https://docs.microsoft.com/en-us/sysinternals/downloads/psexec )

  2. Open a Command Prompt or PowerShell window with Administrator privileges

  3. Navigate to the folder where PsExec is located

  4. Use the following command to run the PowerShell script as SYSTEM with 32bit64-bit Windows PowerShell: pPSEXECPSEXEC -accepteula -i -s -d C:\Windows\SysWOW64\windowsPowerShell\System32\WindowsPowerShell\v1.0\powershell.exe -fileFile "path\to\script.ps1"

Example:

PSEXEC -accepteula -i -s -d C:\Windows\SysWOW64\windowsPowerShell\System32\WindowsPowerShell\v1.0\powershell.exe -fileFile "C:\test\testscript.ps1"

To reproduce a known 32-bit execution path, use C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe instead.

Related Content

Digging Deeper

PsExec Switches

  • -i : runs the programprocess interactively in the interactivespecified modeor (thecurrent userconsole is prompted to confirm the action)session.

  • -s : runs the programprocess as the local SYSTEM accountaccount.

  • -d : runsstarts the program as a background process,process without interactionwaiting for it to finish. Omit this switch when you need to read script output during testing.

  • -accepteula : automatically accepts the PsExec license agreement for the test run.

UsingCalling 64bit64-bit PowerShell from a 32-bit process

Keep this compatibility pattern only for scripts that can still start in a 32bit32-bit PowerShellprocess scriptand

Sometimes,must certainrelaunch tasksthemselves cannotin be accomplished using 32bit64-bit PowerShell. ToSysnative overcomebypasses thisWindows limitation,filesystem theredirection followingfrom codethat can32-bit be used to run a 64bit PowerShell script within a 32bit PowerShell script.process.

If ( [IntPtr]::Size * 8 -ne 64 )
{
    C:\Windows\SysNative\WindowsPowerShell\v1.0\PowerShell.exe -File $MyInvocation.MyCommand.Path
}
Else
{
    # Add code here
}

ThisThe code block checks whether the processorcurrent architectureprocess isarchitecture. A 32-bit process relaunches the same script through Sysnative; a 64-bit orprocess notcontinues into the Else block.

Run the test on a representative Windows device, review the exit code and runsoutput, then pilot the scriptFileWave indeployment 64-bitbefore mode andexpanding the main script can be run here. It is important to note that running the script in 64-bit mode should only be done when it is not possible to accomplish a task using 32bit PowerShell.association.

It is always recommended to test the script in a test environment to avoid any misconfigurations, and to make sure it is working as expected.

Back to top